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DEPARTMENT  OF  HEALTH, 
EDUCATION,  AND  WELFARE 

Social  Security  Administration 

[20  CFR  Part  401] 

Disclosure  of  Official  Records  and 
Information  About  Individuals 

agency:  Social  Security  Administration, 
HEW. 

action:  Proposed  Rule. 

summary:  The  proposed  regulation 
describes  the  general  principles  the 
Social  Security  Administration  will  use 
to  decide  when  to  disclose  ofHcial 
records  and  information  about 
individuals  and  the  limitations  on  those 
disclosures.  This  regulation  implements 
the  provisions  of  the  Privacy  Act  of 
1974,  the  Freedom  of  Information  Act 
and  its  amendment  by  the  Government 
in  the  Sunshine  Act,  the  Tax  Reform  Act 
of  1976,  and  section  1106  of  the  Social 
Security  Act, 

DATE:  Comments  must  be  received  on  or 
before  June  11, 1979. 

ADDRESSES:  Written  comments  may  be 
submitted  to  the  Commissioner  of  Social 
Security,  Department  of  Health, 
Education,  and  Welfare,  P.O.  Box  1585, 
Baltimore,  Maryland  21203. 

Copies  of  all  comments  received  in 
response  to  this  notice  will  be  available 
for  public  inspection  and  copying  during 
regular  business  hours  at  the 
Washington  Inquiries  Section,  OfHce  of 
Information,  Social  Security 
Administration,  Department  of  Health, 
Education,  and  Welfare,  North  Building. 
Room  5131,  330  Independence  Avenue, 
SW.,  Washington,  D.C.  20201. 

FOR  FURTHER  INFORMATION  CONTACr. 
Armand  Esposito,  Legal  Assistant,  6401 
Security  Boulevard,  Baltimore, 

Maryland  21235,  (301)  594-7455. 
SUPPLEMENTARY  INFORMATION: 
Introduction 

This  proposal  is  the  first  major 
revision  of  Regulation  No.  1  since  1955. 

The  Social  Security  Administration 
(SSA)  has  always  followed  a  policy  of 
strict  confidentiality  of  its  records.  Since 
1939,  section  1106  of  the  Social  Security 
Act  has  been  the  basic  authority  for  that 
policy.  Section  1106  prohibited  the 
disclosure  of  information  from  SSA's 
records  except  as  permitted  in 
regulations  issued  by  the  Secretary  of 
HEW.  Section  1106  gave  the  Secretary  of 
HEW  the  discretion  to  decide  what 
these  regulations  should  be. 

The  1967  Freedom  of  Information  Act 
(FOIA)  directed  the  Government  to 


make  many  of  its  records  public,  but 
permitted  section  1106  to  be  recognized 
as  a  controlling  statute.  Therefore,  the 
Secretary’s  regulations  on 
conHdentiality  of  information  continued 
to  provide  authority  for  refusal  to 
disclose  even  though  the  FOIA  would 
otherwise  require  or  permit  it.  As  a 
result,  SSA  did  not  change  its  policies 
regarding  disclosure  of  personal 
information.  The  Privacy  Act  of  1974 
had  little  effect  on  SSA’s  disclosure 
policies  since  these  policies  were 
generally  more  strict  than  those  required 
by  the  Privacy  Act.  A  major  change 
came,  however,  when  Congress  enacted 
the  Government  in  the  Sunshine  Act, 
effective  March  12, 1977. 

The  Government  in  the  Sunshine  Act, 
in  effect,  provided  that  the  Secretary’s 
discretion  to  deny  disclosure  requests 
under  section  1106  of  the  Social  Security 
Act  would  no  longer  be  the  basis  for  an 
exemption  from  disclosure  under  the 
FOIA. 

The  Department  has  published  interim 
regulations  on  disclosure  which 
complied  with  the  provisions  in  the 
Government  in  the  Sunshine  Act.  These 
regulations  were  published  in  the 
Federal  Register  on  March  16, 1977  (42 
FR  14705).  They  are  quite  general.  In  this 
Notice  of  Proposed  Rulemaking,  we  are 
proposing  rules  on  disclosure  of 
personal  information  which  describe  the 
principles  we  will  use  to  determine 
whether  information  may  be  disclosed 
to  someone  other  than  the  individual  to 
whom  the  information  relates. 

Disclosure  of  non-personal  information 
will  continue  to  be  governed  by  the 
FOIA  rules  in  HEW  regulations  (45  CFR 
Part  5)  and  in  SSA’s  regulation  in 
Subpart  E  of  Part  22  of  this  chapter. 

Affected  HEW  Components 

These  regulations  replace  the  interim 
regulations  on  disclosure  for  SSA, 
Included  within  SSA  is  the  Office  of 
Family  Assistance  (OFA)  which  is 
responsible  for  the  Aid  to  Families  with 
Dependent  Children  program.  These 
regulations  apply  to  information  that 
OFA  has.  The  rules  on  disclosure  of 
personal  information  that  States,  local 
governments  and  others  have  under 
AFDC  program  are  in  45  CFR  205.50. 

The  interim  regulations  will  continue 
to  apply  to  the  Health  Care  Financing 
Administration’s  disclosure  of  Medicare 
(title  XVIII)  program  information  until 
HEW  publishes  new  regulations 
regarding  that  information.  We  have 
modified  the  interim  regulations  to  show 
that  they  will  apply  only  to  the  Health 
Care  Financing  Administration  after 
these  regulations  are  published  as  final 
rules. 


Basic  Rules 

When  a  Federal  law  requires  that  we 
disclose  information  for  a  particular 
reason,  we  will  comply  with  that 
requirement  (§  401.205).  For  example, 
the  law  requires  us  to  furnish 
information  to  the  Parent  Locator 
Service  to  help  locate  absent  parents  to 
enforce  support  obligations,  and  to  the 
Immigration  and  Naturalization  Service 
to  carry  out  its  duties  regarding  aliens. 

When  a  Federal  law  prohibits  us  from 
disclosing  certain  information,  we  will 
comply  with  that  prohibition  (§  401.210). 
For  example,  the  Internal  Revenue  Code 
generally  prohibits  SSA  from  disclosing 
tax  return  information.  This  includes,  for 
example,  amounts  of  wages  and 
contributions  from  employers  in  tax 
returns  which  have  been  filed  with  the 
Internal  Revenue  Service  and  which 
SSA  receives  to  maintain  individual 
earnings  records. 

When  no  law  speciHcally  requires  or 
prohibits  disclosure  and  the  individual 
has  not  given  consent  to  disclose',  we 
propose  to  use  the  principles  in  the 
FOIA  to  decide  whether  or  not  to 
disclose  information.  We  will  use  these 
principles  whether  or  not  the  FOIA 
governs  in  a  particular  disclosure 
question.  For  example,  the  FOIA  does 
not  apply  too  requests  from  another 
Federal  agency,  but  we  will  apply  the 
same  principles.  We  will  then  be  able  to 
use  a  uniform  set  of  criteria  for 
evaluating  all  disclosure  questions.  We 
have  been  doing  this  since  the 
Government  in  the  Sunshine  Act 
became  effective  in  March  1977. 

Freedom  of  Information  Act  Rule 

The  basic  intent  of  the  FOIA  is  to 
require  that  records  be  made  public,  and 
even  when  withholding  is  permitted 
because  one  of  the  exemptions  in  the 
FOIA  applies,  records  must  be  released 
(if  not  prohibited  by  another  law)  unless 
disclosure  could  result  in  demonstrable 
harm.  The  FOIA  exemption  which  most 
often  applies  to  SSA  disclosure 
questions  is  whether  the  disclosure 
would  result  in  a  “clearly  unwarranted 
invasion  of  personal  privacy.”  We  apply 
this  test  by  considering — 

(1)  The  sensitivity  of  the  information 
to  the  individuals  (e.g.,  whether 
individuals  would  suffer  harm  or 
embarrassment  as  a  result  of 
disclosure): 

(2)  The  public  interest  in  the 
disclosure; 

(3)  Individuals’  rights  and 
expectations  to  have  their  personal 
information  kept  conHdential;  and 
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(4)  The  public’s  interest  in  maintaining 
general  standards  of  confidentiality  of 
personal  information. 

For  example,  we  believe  that  there  is 
a  strong  public  interest  in  sharing 
information  with  other  agencies  with 
programs  having  the  same  or  similar 
purposes;  we  generally  share 
information  with  those  agencies. 
However,  there  is  usually  little  or  no 
public  interest  in  disclosing  information 
for  disputes  between  two  private  parties 
or  for  other  private  or  commercial 
purposes;  we  generally  do  not  share 
information  for  these  purposes.  We 
describe  these  rules  in  §  401.300  of  the 
regulation. 

Other  General  Rules 

The  other  provisions  of  the  regulation 
describe  the  principles  we  will  use  when 
the  Privacy  Act  would  permit  disclosure. 
Generally,  these  rules  apply  to 
situations  when,  considering  the  nature 
and  vast  amount  of  SSA  records,  we 
believe  the  FOIA  exemption  of  “clearly 
unwarranted  invasion  of  personal 
privacy”  permits  a  more  limited 
disclosure  policy  than  the  Privacy  Act 
allows. 

(1)  Disclosures  within  HEW 

/■§  401.305).  The  Privacy  Act  allows  the 
sharing  of  information  within  an  agency 
when  needed  to  carry  out  its  duties. 
HEW  is  an  agency  under  both  the 
Privacy  Act  and  the  FOIA.  Therefore,  to 
the  extent  disclosure  is  not  prohibited 
by  another  law,  we  will  share  with  other 
parts  of  HEW  the  information  they  need 
from  our  records  to  carry  out  their 
duties. 

(2)  Routine  use  and  compatibility 
(%  401.310).  The  Privacy  Act  allows  an 
agency  to  disclose  information  routinely 
without  an  individual’s  consent  if  the 
information  is  to  be  used  for  a  purpose 
which  is  compatible  with  the  purposes 
for  which  the  information  was  collected. 
We  disclose  information  for  “routine 
uses”  where  necessary  to  carry  out 
SSA’s  programs.  We  also  disclose 
information  for  use  in  other  programs 
which  have  purposes  similar  to  the 
purposes  of  SSA's  programs. 

Since  the  purpose  of  SSA’s  programs 
is  basic  income  maintenance,  we 
consider  another  program  to  be 
“compatible”  when  its  purpose  is  cash 
income  maintenance  (e.g.,  veterans’ 
benefits,  railroad  retirement  annuities, 
worker’s  compensation,  unemployment 
compensation,  etc.),  or  noncash  income 
maintenance  (e.g.,  food  stamps  or  rent 
subsidy).  In  addition,  SSA  still  retains 
many  responsibilities  for  the  Medicare 
program  now  under  the  Health  Care 
Financing  Administration,  Therefore,  we 
consider  health  insurance  or  health 


services  programs  (e.g..  Medicare, 
Medicaid,  or  the  uniformed  services 
health  programs)  to  be  compatible  with 
SSA’s  programs. 

We  will  also  disclose  information 
under  appropriate  circumstances  for 
epidemiological  and  similar  research. 
We  consider  this  health-related  activity 
to  be  a  compatible  purpose,  since  it  may 
help  prevent  or  lessen  diseases,  and 
thus  may  reduce  the  need  for  benefits 
under  health  maintenance  programs. 

(3)  Law  enforcement  (%  401.315).  The 
Privacy  Act  permits  disclosure  needed 
to  investigate  or  prosecute  suspected 
fraud  or  abuse  in  a  social  security 
program  or  a  similar  program.  In 
addition,  the  Privacy  Act  permits  a 
broad  range  of  disclosures  for  civil  or 
criminal  law  enforcement  activities. 
However,  the  Senate  Government 
Operations  Committee  report  on  the 
Privacy  Act  (Sen.  Rep.  No.  93-1183,  p. 

73)  states: 

In  requiring  that  the  agency  rule  on  each 
request  on  a  case-by-case  basis,  it  is  hoped 
that  secret  law  enforcement  access,  that  is 
disclosure  without  notification  to  the  subject 
of  the  file,  will  only  be  permitted  in  the  most 
exigent  and  essential  circumstances. 

We  believe  that  disclosure  in  this  area 
should  be  limited  because,  unless  there 
are  clearly  defined  situations  for 
disclosure,  it  is  difficult  to  determine 
what  is  in  the  public  interest  and  what  is 
a  “clearly  unwarranted  invasion  of 
personal  privacy.”  Therefore,  we  believe 
that  information  should  be  released 
only— 

(1)  In  cases  of  national  security; 

(2)  In  situations  involving  an  imminent 
danger  to  human  life  (like  hijacking, 
holding  hostages,  or  acts  of  terrorism); 

(3)  In  criminal  investigations  involving 
a  violent  felony  (like  murder  or 
kidnapping)  which  have  narrowed  to 
specific  suspects;  and 

(4)  In  situations  involving  criminal 
abuse  of  a  social  security  program  or 
similar  program. 

Disclosures  and  Safeguards  for 
Research  and  Statistical  Purposes 

We  propose  to  continue  disclosing 
information  for  statistical  and  research 
purposes.  We  w’ill  disclose,  if  the 
following  conditions  apply — 

(1)  The  agency  requesting  the 
information  consents  to  use  it  only  for 
research  and  statistical  purposes,  and 
will  protect  individuals  from 
unreasonable  and  unwanted  contacts; 

(2)  The  activity  is  related  to  the  social 
security  program  or  other  income  or 
health  maintenance  programs,  including 
epidemiological  and  similar  research, 
and 


(3)  The  requesting  agency  meets  the 
rules  we  have  for  safeguarding  its 
conhdentiality.  Research  about  the 
nation’s  income,  work,  social,  age,  and 
health  patterns  is  clearly  in  the  public 
interest.  Since  SSA  itself  uses  data  in  its 
records  for  research  and  statistical 
purposes,  we  believe  disclosure  to  other 
agencies  for  those  purposes  is 
permissible  under  the  Privacy  Act. 
Moreover,  the  safeguards  we  will  insist 
upon  should  insure  that  the  information 
is  not  further  disclosed  or  used  for 
nonresearch  purposes.  The  new 
regulation  would  permit  disclosure  of 
data  identifying  specibc  individuals  only 
in  limited  circumstances. 

Court  Orders 

The  Privacy  Act  allows  disclosure  to 
comply  with  any  court  order.  However, 
as  in  the  area  of  law  enforcement,  there 
are  strong  reasons  for  limiting  the  scope 
of  these  disclosures.  Since  participation 
in  the  social  security  programs  is 
compulsory,  individuals  have  little 
choice  in  the  amount  or  kinds  of 
information  which  we  collect  and  keep 
about  them.  Court  testimony  generally 
becomes  a  matter  of  public  record,  so 
there  can  be  no  further  protection  of  its 
confidentiality.  Furthermore,  the 
information  requested  is  often  more 
readily  available  from  other  sources  or 
with  the  consent  of  the  person 
concerned.  These  factors  all  argue  for  a 
restrictive  position. 

Accordingly,  we  disclose  information 
in  response  to  court  orders  if — 

(1)  Another  section  of  the  regulation 
would  allow  the  release;  or 

(2)  The  Secretary  of  HEW  is  a  party  to 
the  proceeding;  or 

(3)  The  information  is  necessary  for 
due  process  in  a  criminal  proceeding. 

In  other  cases,  we  disclose 
information  in  response  to  the  needs  of 
the  courts  while  trying  to  preserve  the 
confidentiality  of  information. 

Obtaining  and  Correcting  Your  Record 

Sections  401.400  through  401.420 
discuss  how  to  request  information  from 
your  record,  and  how  to  correct  any 
information  with  which  you  do  not 
agree. 

The  sensitive  nature  of  medical 
information  causes  special  problems  in 
guaranteeing  individuals  the  right  to  all 
information  in  an  agency’s  files  about 
them.  Sometimes,  a  person’s  health 
might  be  harmed  if  he  or  she  knew  what 
was  in  a  medical  record. 

The  Privacy  Act  guarantees  an 
individual  the  right  to  know  what 
records  an  agency  maintains  about  him 
or  her,  but  also  allows  an  agency  to  set 
up  special  procedures  for  giving  an 
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individual  access  to  medical  records. 
The  proposed  regulation  requires  an 
individual  to  name  a  doctor  or  some 
o,ther  responsible  representative 
whenever  the  individual  wants  to  have 
access  to  a  medical  record.  If  we  feel 
that  the  information  might  harm  the 
individual,  the  report  will  be  sent  to  the 
representative  that  the  individual 
named. 

We  believe  this  procedure  protects 
the  individual  from  harm  that  might 
occur  if  he  or  she  received  the  report 
directly,  and  also  protects  the 
individual's  right  under  the  Privacy  Act 
to  have  access  to  information  in  an 
agency’s  files  about  him  or  her. 

Appeals 

Sections  401.500  through  401.510 
discuss  how  to  appeal  any  decision  in 
which  we  refuse  to  correct  a  record, 
refuse  to  disclose  information,  or  refuse 
to  grant  access  to  a  record. 

(Catalog  of  Federal  Domestic  Assistance 
Programs  No.  13.802-13.805  and  13.807-13.814. 
Social  Security  Programs) 

Dated:  March  19, 1979. 

Stanfoni  C.  Rau. 

Commissioner  of  Social  Security. 

Approved:  March  30, 1979. 
loceph  A.  Califano.  |r.. 

Secretary  of  Health,  Education,  and  Welfare. 

20  CFR  Part  401  is  amended  as 
follows: 

1.  Subpart  A  is  transferred  to  42  CFR 
Chapter  IV  and  redesignated  as  new 
Part  401 — Disclosure  of  Official  Records 
and  Information. 

2.  In  §  401.1,  paragraph  (a)  is  revised 
to  read  as  follows; 

§401.1  Purpose  and  scope. 

(a)  The  Regulations  in  this  Part 
implement  section  1106(a)  of  the  Social 
Security  Act  as  it  applies  to  the  Health 
Care  Financing  Administration.  The 
rules  apply  to  information  obtained  by 
officers  or  employees  of  the  Health  Care 
Financing  Administration  in  the  course 
of  administering  title  XVIII  of  the  Social 
Security  Act.  information  obtained  by 
Medicare  intermediaries  or  carriers  in 
the  course  of  carrying  out  agreements 
under  sections  1816  and  1842  of  the 
Social  Security  Act,  and  any  other 
information  subject  to  section  1106(a)  of 
the  Social  Security  Act. 
***** 

3.  Subpart  B  is  redesignated  as 
Subpart  F  and  the  sections  are 
renumbered  accordingly. 

4.  The  table  of  contents  for  Part  401  to 
20  CFR  reads  as  follows: 


Subpart  A— General  Provisions 

Sec. 

401.100  Purposes  of  the  regulation. 

401.105  When  the  regulation  applies. 

401.110  Terms  defined. 

401.115  Situations  not  specified  in  this  part. 
401.120  Safeguards  against  unauthorized 
disclosure  or  use.  ' 

401.125  Fees. 

Subpart  B— How  Laws  Apply 

401.200  General. 

401.205  Disclosures  required  by  law. 

401.210  Disclosures  prohibited  by  law. 
401.215  Freedom  of  Information  Act. 

401.220  Other  laws. 

Subpart  C— Individual  Disclosures 

401.300  General  principles. 

401.305  Within  HEW. 

401.310  Compatible  purposes. 

401.315  Law  enforcement  purposes. 

401.320  Health  or  safety. 

401.325  Statistical  and  research  activities. 
401.330  Congress. 

401.335  General  Accounting  Office.* 

401.340  Courts. 

401.345  Other  specific  recipients. 

401.350  Deceased  persons. 

Subpart  D — Obtaining  and  Correcting  Your 
Records 

401.400  General. 

401.405  How  to  get  your  own  record. 

401.410  Medical  information. 

401.415  Records  about  two  or  more 
individuals. 

401.420  How  to  correct  your  record. 

Subpart  E — Appeals 

401.500  Which  decisions  are  covered. 

401.505  Appeal  of  refusal  to  correct  a 
record. 

401.510  Appeals  after  denial  of  disclosure  or 
access. 

Subpart  F— Disclosure  of  Wage  Information 
for  Programs  of  Aid  to  Families  With 
Dependent  Children 

401.600  Purpose  and  scope. 

401.601  Definitions. 

401.602  When  information  may  be 
disclosed. 

401.603  information  which  is  necessary. 

401.604  Protection  of  confidentiality. 
Authority:  Secs.  205, 1102,  and  1106  of  the 

Social  Security  Act;  53  Stat.  1368,  as 
amended,  49  Stat.  647,  as  amended,  53  Stat. 
1398.  as  amended,  sec.  290,  66  Stat.  234;  (42 
U.S.C.  405. 1302, 1306:  8  U.S.C.  1360):  sec. 
413(b)  of  the  Federal  Coal  Mine  Health  and 
Safety  Act  of  1969,  83  Stat.  794:  30  U.S.C.  923. 
5  U.S.C.  552a  (Privacy  Act):  5  U.S.C.  552 
(Freedom  of  Information  Act),  as  amended  by 
Pub.  L.  94-409,  90  Stat.  1241;  26  U.S.C.  6103.  as 
amended  by  Pub.  L.  94-455,  90  Stat.  1667  (Tax 
Reform  Act  of  1976). 

5.  New  Subparts  A  through  E  are 
added  to  read  as  follows: 


Subpart  A— General  Provisions 

§  401.100  Purposes  of  the  regulation. 

The  Social  Security  Administration 
(SSA)  generally  provides  information 
which  individuals  request  about 
themselves.  This  regulation  describes 
how  individuals  may  get  access  to  their 
own  records.  This  regulation  also 
describes  the  rules  SSA  uses  to  decide 
whether  to  disclose  information  about 
individuals  without  their  consent.  These 
rules  are  set  out  in  Subparts  A  through  E 
of  this  part.  These  rules  comply  with  the 
Freedom  of  Information  Act,  the  Privacy 
Act,  section  1106  of  the  Social  Security 
Afct,  and  other  applicable  statutes. 

.  When  required  by  the  Privacy  Act,  SSA 
publishes  notices  of  routine  use  for 
public  information  and  comment. 
Procedures  for  requesting  information 
are  in  §  §  422.428  and  422.436  of  this 
chapter  and  45  CFR  Parts  5  and  5b. 

§  40 1 . 1 05  When  the  regulation  applies. 

(a)  Social  security  records.  This 
regulation  applies  only  to  information 
about  an  individual  contained  in  SSA's 
records.  It  does  not  apply  to — 

(1)  Information  which  is  not  about  an 
individual;  or 

(2)  Information  about  acts  of  SSA 
officials  and  employees  or  to  SSA’s 
personnel  records. 

The  rules  governing  disclosure  of 
information  which  is  not  about  an 
'individual  are  in  45  CFR  Part  5  and 
Subpart  E  of  Part  422  of  this  chapter. 

The  rules  governing  disclosure  of 
information  about  acts  of  SSA  officials 
and  employees  or  of  personnel  records 
are  in  HEW  regulations  (45  CFR  Part  5). 
Information  in  the  possession  of  a  State 
or  local  agency  administering  a  program 
of  Aid  to  Families  with  Dependent 
Children  is  governed  by  the  rules  at  45 
CFR  205.50.  This  regulation  sets  out  the 
general  guidelines  which  we  follow  in 
deciding  whether  to  make  disclosures. 
However,  we  must  examine  the  facts  of 
each  case  separately  to  decide  if  we 
should  disclose  the  information  or  keep 
it  confidential. 

(b)  Health  insurance  records.  This 
regulation  also  applies  to  health 
insurance  records  which  SSA  maintains 
for  the  Health  Care  Financing 
Administration’s  programs  under  title 
XVIII  of  the  Social  Security  Act. 

(c)  Black  lung  benefit  records.  This 
regulation  also  applies  to  records  which 
SSA  maintains  for  the  administration  of 
the  Federal  Coal  Mine  Health  and 
Safety  Act.  However,  this  information  is 
not  covered  by  section  1106  of  the  Social 
Security  Act. 
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§  401.1 10  Terms  defined. 

“Access,”  as  that  term  is  used  in  the 
Privacy  Act  (5  U.S.C.  552a(d)),  means 
the  individual’s  right  to  review,  copy, 
amend  or  correct  records  about  that 
individual. 

"Act”  means  the  Social  Security  Act. 

"Disclosure”  means  the  availability  or 
release  of,  a  record  about  an  individual 
to  another  party. 

“FOIA”  means  the  Freedom  of 
Information  Act. 

"HEW”  means  the  Department  of 
Health,  Education,  and  Welfare. 

“Individual”  means  a  living  natural 
person;  this  does  not  include 
corporations,  partnerships,  and 
unincorporated  business  or  professional 
groups  of  two  or  more  persons. 

"Information  about  an  individual” 
includes,  but  is  not  limited  to,  vital 
statistics;  race,  sex,  or  other  physical 
characteristics;  earnings  information; 
professional  fees  paid  to  an  individual 
and  other  financial  information;  benefit 
data  or  other  claims  information;  the 
social  security  number,  employer 
identification  number,  or  other 
individual  identifier;  address;  phone 
number;  medical  information,  including 
psychological  or  psychiatric  information 
or  lay  information  used  in  a  medical 
determination;  and  information  about 
marital  and  family  relationships  and 
other  personal  relationships. 

“Record”  means  any  item,  collection, 
or  grouping  of  information  about  an 
individual  that  SSA  maintains  (e.g., 
employment  history,  medical  history, 
education]  and  that  contains  his  or  her 
name,  or  an  identifying  number,  symbol, 
or  any  other  means  by  which  an 
individual  can  be  identified. 

"Secretary”  means  the  Secretary  of 
Health,  Education,  and  Welfare  and  any 
individual  authorized  to  act  for  him  or 
her  in  the  administration  of  a  social 
security  program. 

“Social  Security  Administration” 

(SSA)  means  (1)  that  principal  operating 
component  of  the  Department  of  Health, 
Education,  and  Welfare  which  has 
administrative  responsibilities  under 
titles  I,  II,  IV— Part  A,  X,  XI,  XIV,  XVI, 
and  XVIII  of  the  Act;  and  (2)  units  of 
State  governments  which  make 
determinations  under  agreements  made 
under  sections  221  and  1633  of  the  Act. 

"Social  security  program”  means  any 
program  or  provision  of  law  which  SSA 
is  responsible  for  administering, 
including  the  Freedom  of  Information 
Act  and  Privacy  Act.  This  includes  our 
responsibilities  under  Parts  B  and  C  of 
the  Federal  Coal  Mine  Health  and 
Safety  Act. 

"System  of  records”  means  a  group  of 
records  under  our  control  from  which 


information  about  an  individual  is 
retrieved  by  the  name  of  the  individual 
or  by  an  identifying  number,  symbol,  or 
other  identifying  particular. 

"We”  means  the  Social  Security 
Administration. 

§  401.1 15  Situations  not  specified  in  this 
part 

If  no  provision  in  this  regulation 
specifically  allows  SSA  to  disclose 
information,  the  Commissioner  or  his 
designee  may  disclose  this  information 
if  not  prohibited  by  Federal  law. 

§  40 1 . 1 20  Safeguards  against 
unauthorized  disclosure  or  use. 

The  FOIA  does  not  permit  us  to 
impose  any  restrictions  on  how 
information  is  used  after  we  disclose  it 
However,  the  FOIA  does  permit  us  to 
withhold  information  if  disclosure  would 
result  in  a  “clearly  unwarranted 
invasion  of  personal  privacy.”  In 
deciding  whether  this  exemption  applies 
in  a  given  case,  we  must  consider  all  the 
ways  in  which  the  recipient  might  use 
the  information  and  how  likely  the 
recipient  is  to  redisclose  the  information 
to  other  parties.  Thus,  before  we 
disclose  personal  information  we  may 
consider  such  factors  as — 

(a)  Whether  only  those  individuals 
who  have  a  need  to  know  the 
information  will  obtain  it; 

(b)  Whether  appropriate  measures  to 
safeguard  the  information  to  avoid 
unwarranted  use  or  misuse  will  be 
taken;  and 

(c)  Whether  we  would  be  permitted  to 
conduct  on-site  inspections  to  see 
whether  the  safeguards  are  being  met. 

§  401.125  Fees. 

We  follow  HEW  regulations  (45  CFR 
5b.l3)  to  determine  the  amount  of  fees,  if 
any,  to  be  charged  for  providing 
information  under  the  Privacy  Act. 

Subpart  B— How  Laws  Apply 

§  401.200  General. 

This  section  describes  how  various 
laws  control  the  disclosure  or 
confidentiality  of  personal  information 
which  we  keep.  We  must  consider  these 
laws  in  the  following  order. 

(1)  Some  laws  require  us  to  disclose 
information  (§  401.205);  some  laws 
require  us  to  withhold  information 

(§  401.210).  These  laws  control 
whenever  they  apply. 

(2)  If  no  law  of  this  type  applies  in  a 
given  case,  then  we  must  look  to  the 
FOIA.  See  §  401.215. 

(3)  When  the  FOIA  principles  don’t 
require  disclosure,  we  may  disclose 
information  if  both  the  Privacy  Act  and 
the  regulations  implementing  section 


1106  of  the  Social  Security  Act  permit 
the  disclosure.  See  §  401.220. 

§  401.205  Disclosures  required  by  law. 

We  disclose  information  when  a  law 
specifrcally  requires  it.  The  Social 
Security  Act  requires  us  to  disclose 
information  for  certain  program 
purposes.  These  include  disclosures  to 
the  Parent  Locator  Service  and  to  States 
for  the  administration  of  the  Aid  to 
Families  with  Dependent  Children 
program.  Also,  there  are  other  laws 
which  require  that  we  furnish  other 
agencies  information  which  they  need 
for  their  programs.  These  include  the 
Veterans  Administration  for  its  benefrt 
programs,  the  Immigration  and 
Neturalization  Sendee  to  carry  out  its 
duties  regarding  aliens,  and  the  Railroad 
Retirement  Board  for  its  benefit 
programs. 

§  401.210  Disclosures  prohibited  by  law. 

We  do  not  disclose  information  when 
a  law  specifically  prohibits  it.  The 
Internal  Revenue  Code  generally 
prohibits  us  from  disclosing  tax  return 
information  which  we  receive  to 
maintain  individual  earnings  records. 
This  includes,  for  example,  amounts  of 
wages  and  contributions  from 
employers.  Other  laws  restrict  our 
disclosure  of  information  about  drug  and 
alcohol  abuse  which  we  collect  to 
determine  eligibility  for  social  security 
benefrts. 

§  401.215  Freedom  of  Information  Act. 

The  FOIA  requires  us  to  disclose  any 
information  in  our  records  upon  written 
request  from  the  public,  unless  one  of 
several  exemptions  in  the  FOIA  applies. 
“The  public”  does  not  include  Federal 
agencies,  courts,  or  the  Congress,  but 
does  include  State  agencies,  individuals, 
corporations,  and  most  other  parties. 

The  FOIA  does  not  apply  to  requests 
that  are  not  from  “the  public”  (e.g.,  from 
a  Federal  agency)  or  when  there  is  no 
written  request.  However,  we  apply 
FOIA  principles  to  requests  from  these 
sources  for  disclosure  of  information 
(see  §  401.300;  also  see  §§  401.330  and 
401.335  for  disclosures  to  Congress  and 
the  General  Accounting  Office  (GAO)). 

§  401.220  Other  laws. 

When  the  FOIA  does  not  apply,  we 
may  not  disclose  any  personal 
information  unless  both  the  Privacy  Act 
and  section  1106  of  the  Social  Security 
Act  permit  the  disclosure.  Sections 
401.305  through  401.340  discuss  how  we 
apply  the  various  provisions  of  the 
Privacy  Act  that  permit  disclosure. 
Section  1106  of  the  Social  Security  Act 
requires  the  Secretary  of  HEW  to  set  out 
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in  regulations  what  disclosures  may  be 
made;  therefore,  any  disclosure 
permitted  by  this  regulation  is  permitted 
by  section  1106. 

Subpart  C — Individual  Disclosures 

§  401.300  General  principles. 

(a)  This  subpart  describes  how  we 
decide  whether  to  disclose  information 
when  no  law  specifically  requires 
disclosure  nor  prohibits  it. 

(b)  We  follow  the  FOIA  principles 
even  if  there  is  no  written  request  or  the 
FOIA  does  not  apply  to  a  written 
request.  For  example,  the  FOIA  does  not 
apply  when  the  request  is  from  a 
Federal  agency  or  a  court.  We  follow 
these  principles  to  insure  uniform 
treatment  in  all  instances. 

(c)  The  FOIA  principle  which  most 
often  applies  to  SSA  disclosure 
questions  is  whether  the  disclosure 
would  result  in  a  “clearly  unwarranted 
invasion  of  personal  privacy.”  To  decide 
whether  a  disclosure  would  be  a  clearly 
unwarranted  invasion  of  personal 
privacy  we  consider — 

(1)  The  sensitivity  of  the  information 
(e.g.,  whether  individuals  would  suffer 
harm  or  embarrassment  as  a  result  of 
the  disclosure); 

(2)  The  public  interest  in  the 
disclosure; 

(3)  The  rights  and  expectations  of 
individuals  to  have  their  personal 
information  kept  confidential;  and 

(4)  The  public’s  interest  in  maintaining 
general  standards  of  confidentiality  of 
personal  information. 

We  feel  that  there  is  a  strong  public 
interest  in  sharing  information  with 
other  agencies  with  programs  having  the 
same  or  similar  purposes,  so  w'e 
generally  share  information  with  those 
agencies.  However,  there  is  usually  little 
or  no  public  interest  in  disclosing 
information  for  disputes  between  two 
private  parties  or  for  other  private  or 
commehcal  purposes;  we  generally  do 
not  share  information  for  these 
purposes. 

§401.305  Within  HEW. 

The  Privacy  Act  allows  an  agency  to 
share  information  inside  the  agency 
when  necessary  for  the  agency  to  carry 
out  its  duties.  For  purposes  of  this 
provision,  HEW  considers  itself  one 
“agency.”  SSA.  as  a  part  of  HEW, 
discloses  information  to  another  HEW 
component  when  SSA  determines  that 
the  other  component  has  a  legitimate 
need  for  the  information  and  no  other 
law  prohibits  it 

§  401.310  Compatible  purposes. 

(a)  General  The  Privacy  Act  allows 
us  to  disclose  information,  without  the 


consent  of  the  individual,  to  any  other 
party  for  “routine  uses." 

fb)  "Routine  use.  ’’This  means  the 
disclosure  of  a  record  outside  HEW  for 
a  purpose  which  is  “compatible"  with 
the  purpose  for  which  the  record  was 
collected. 

(c)  Determining  compatibility.  We 
disclose  information  for  “routine  uses” 
where  necessary  to  carry  out  SSA’s 
programs.  We  also  disclose  information 
for  use  in  other  programs  which  have 
purposes  similar  to  the  purposes  of 
SSA’s  programs.  For  example,  we 
disclose  information  to  the  Railroad 
Retirement  Board  for  p>ension  and 
unemployment  compensation  programs, 
to  the  Vetera.ns  Administration  for  its 
benefit  program,  to  worker's 
compensation  programs,  to  State  general 
assistance  programs,  and  to  other 
governmental  income  maintenance 
programs;  we  also  disclose  for  health- 
maintenance  programs  like  Medicare 
and  Medicaid,  and  in  appropriate  cases, 
for  epidemiological  and  similar  research. 
We  publish  notices  of  systems  of 
records  in  the  Federal  Register  which 
contain  a  list  of  all  “routine  use” 
disclosures. 

§  401.315  Law  enforcement  purposes. 

(a)  General.  The  Privacy  Act  allows 
us  to  disclose  information  for  law 
enforcement  purposes  under  certain 
conditions.  Much  of  the  information  in 
our  files  is  especially  sensitive  or  very 
personal.  Furthermore,  participation  in 
social  security  programs  is  mandatory, 
so  people  cannot  limit  what  information 
is  given  to  us.  Therefore,  we  generally 
disclose  information  for  law 
enforcement  purposes  only  in  limited 
situations.  Paragraphs  (b),  (c),  and  (d)  of 
this  section  discuss  the  disclosures  we 
generally  make  for  these  purposes. 

(b)  National  security.  We  disclose 
information  to  the  Federal  Bureau  of 
Investigation  or  the  U.S.  Secret  Service 
for  their  investigations  or  prosecutions 
involving  national  security.  These 
include  investiagations  of  the 
commission,  attempted  commission,  or 
the  threatened  commission  of  an  act  of 
assassination,  espionage,  or  sabotage.  In 
these  cases,  we  make  the  disclosure 
only  if  the  head  of  the  requesting  agency 
(or  his  or  her  designee)  certifies  in 
writing  that  the  information  is  needed  to 
protect  the  national  security. 

(c)  Other  serious  crimes.  SSA  may 
disclose  information  for  other  criminal 
law  enforcement  purposes  if  there  is 
imminent  danger  to  human  life  (like 
hijacking,  holding  hostages,  or  acts  of 
terrorism),  or  if — the  crime  is  a  violent 
felony  like  murder  or  kidnapping;  and  if 
the  law  enforcement  agency  has 


narrowed  its  investigation  down  to  a 
specific  suspect  or  suspects. 

The  Privacy  Act  allows  use  to  disclose  if 
the  head  of  the  law  enforcement  agency 
makes  a  written  request  giving  enough 
information  to  show — That  these 
conditions  are  met;  What  information  is 
needed;  and  Why  it  is  needed. 

(d)  Criminal  abuse  of  a  social  security 
program  or  similar  program.  We 
disclose  information  when  necessay  to 
investigate  or  prosecute  alleged  or 
suspected  fraud  or  similar  criminal 
abuse  in  a  social  security  program.  We 
also  disclose  for  the  same  purposes  for 
other  income-maintenance  or  health- 
maintenance  programs  (e.g.,  other 
governmental  pension  programs, 
unemployment  compensation,  general 
assistance.  Medicare,  or  Medicaid). 

§  401.320  Health  or  safety. 

The  Privacy  Act  allows  us  to  disclose 
informaton  in  compelling  circumstances 
where  an  individual’s  health  or  safety  is 
affected.  For  example,  if  we  learn  that 
someone  has  been  exposed  to  an 
excessive  amount  or  radiation,  we  may 
notify  that  person  and  appropriate 
health  officials.  If  we  learn  that 
someone  has  made  a  threat  against 
someone  else,  we  may  notify  that  other 
person  and  law  enforcement  officials. 
When  we  make  these  disclosures,  the 
Privacy  Act  requires  us  to  send  a  notice 
of  the  disclosure  to  the  last  known 
address  of  the  person  whose  record  was 
disclosed. 

§  401.325  Statistical  and  research 
activities. 

(a)  General.  Statistical  and  research 
activities  often  do  not  require 
information  in  a  format  that  identifies 
specific  individuals.  Therefore, 
whenever  possible,  we  release 
information  for  statistical  or  research 
purposes  only  in  the  form  of  aggregates 
or  individual  data  that  cannot  be 
associated  with  a  particular  individual. 
The  Privacy  Act  allows  us  to  release 
records  if  there  are  safeguards  that  the 
record  wtll  be  used  solely  as  a  statistical 
or  research  record  and  the  individual 
cannot  be  identified  from  any 
information  in  the  record. 

(b)  Safeguards  for  disclosure  with 
identifiers.  The  Privacy  Act  also  allows 
us  to  disclose  data  for  statistical  and 
research  purposes  in  a  form  allowing 
individual  identification  when  the 
purpose  is  compatible  with  the  purpose 
for  which  the  record  was  collected.  We 
will  disclose  personally  identifiable 
information  for  statistical  and  research 
purposes  if — 

(1)  We  determine  that  requester  needs 
the  information  in  an  identifiable  form 
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for  a  statistical  or  research  activity,  will 
use  the  information  only  for  that 
purpose,  and  will  protect  individuals 
bom  unreasonable  and  unwanted 
contacts: 

(2)  The  activity  is  designed  to  increase 
knowledge  about  present  or  alternative  - 
social  security  programs  or  other 
Federal  or  State  income-maintenance  or 
or  health-maintenance  programs,  or 
consists  of  epidemiological  or  similar 
research;  and 

(3)  The  recipient  will  keep  the 
information  as  a  system  of  statistical 
records  and  will  follow  appropriate 
safeguards  so  we  can  be  sure  the 
information  is  used  or  redisclosed  only 
for  statistical  or  research  purposes.  No 
redisclosure  of  the  information  may  be 
made  without  SSA's  approval.  We  will 
also  require  these  safeguards  when  we 
disclose  personally  identifiable 
information  to  another  HEW  component 
for  its  own  statistical  or  research 
functions  (see  §  401.305). 

(c)  Statistical  record.  A  statistical 
record  is  a  record  in  a  system  of  records 
which  is  maintained  only  for  statistical 
and  research  purposes,  and  which  is  not 
used  to  make  any  determination  about 
an  individual.  We  maintain  and  use 
statistical  records  only  for  statistical 
and  research  purpose.  We  may  disclose 
a  statistical  record  if  the  conditions  in 
paragraph  (b)  of  this  section  are  met. 

(d)  Compiling  of  records.  Where  a 
request  for  information  for  statistical 
and  research  purposes  would  require  us 
to  compile  records,  and  doing  that 
would  be  administratively  burdensome 
to  ongoing  SSA  operations,  we  may 
decline  to  furnish  the  information. 

§  401.330  Congress. 

(a)  We  disclose  information  to  either 
House  of  Congress.  We  also  disclose 
information  to  any  committee  or 
subcommittee  of  either  House,  or  to  any 
joint  committee  of  Congress  or 
subcommittee  of  that  committee,  if  the 
information  is  on  a  matter  within  the 
committee’s  or  subcommittee's 
jurisdiction. 

(b)  We  disclose  to  any  member  of 
Congress  the  information  needed  to 
respond  to  constituents’  requests  for 
information  about  themselves  (including 
requests  from  parents  of  minors,  or  legal 
guardians).  However,  these  disclosures 
are  subject  to  the  restrictions  in 

§  401.400. 

S  401.335  General  Accounting  Office. 

We  disclose  information  to  the 
General  Accounting  Office  when  that 
agency  needs  the  information  to  carry 
out  its  duties. 


§401.340  Courts. 

(a)  General.  The  Privacy  Act  allows 
us  to  disclose  information  when  we 
receive  an  order  from  a  court  of 
competent  jurisdiction.  However,  much 
of  our  information  is  especially 
sensitive.  Participation  in  social  security 
programs  is  mandatory,  and  so  people 
cannot  limit  what  information  is  given  to 

.SSA.  When  information  is  used  in  a 
court  proceeding,  it  usually  becomes 
public  knowledge,  and  its  confidentiality 
cannot  be  protected.  Therefore,  we  treat 
subpoenas  or  other  court  orders  for 
information  under  the  rules  in  paragraph 

(b)  of  this  section. 

(b)  We  disclose  information  in 
response  to  court  orders  if — 

(1)  Another  section  of  this  part  would 
allow  the  release;  or 

(2)  The  Secretary  of  HEW  is  a  party  to 
the  proceeding;  or 

(3)  The  information  is  necessary  for 
due  process  in  a  criminal  proceeding. 

In  other  cases,  we  try  to  satisfy  the 
needs  of  courts  while  preserving  the 
confidentially  of  information. 

§  401.345  Other  specific  recipients. 

In  addition  to  disclosures  we  make 
imder  the  “routine  use’’  provision,  we 
also  release  information  to — 

(a)  'The  Bureau  of  the  Census  for 
purposes  of  planning  or  carrying  out  a 
census,  survey,  or  related  activity;  and 

(b)  The  National  Archives  of  the 
United  States  if  the  record  has  sufficient 
historical  or  other  value  to  warrant  its 
continued  preservation  by  the  United 
States  Government.  We  also  disclose  a 
record  to  the  Administrator  of  General 
Services  for  a  determination  whether 
the  record  has  such  a  value. 

§  401.350  Deceased  persons. 

We  do  not  consider  the  disclosure  of 
information  about  a  deceased  person  to 
be  a  clearly  unwarranted  invasion  of 
that  person’s  privacy.  However,  in 
disclosing  information  about  a  deceased 
person,  we  insure  that  the  privacy  rights 
of  a  living  person  are  not  violated. 

Subpart  D — Obtaining  and  Correcting  . 
Your  Records 

401.400  General. 

The  Freedom  of  Information  Act 
allows  you  to  request  information  from 
SSA  whether  or  not  it  is  in  a  system  of 
records.  The  Privacy  Act  gives  you  the 
right  to  have  access  to  most  records 
about  yourself  that  are  in  our  systems  of 
records.  Exceptions  to  this  right 
include — 

(a)  Certain  medical  records  (see  5 
U.S.C.  552a(f)(3)  and  section  401.510); 


(b)  Certain  criminal  law  enforcement 
records  (see  5  U.S.C.  552a  (j)  and  (k), 
and  HEW’s  rule  in  45  CFR  5j.11);  and 

(c)  Records  compiled  in  reasonable 
anticipation  of  a  court  action  or  formal 
administrative  proceeding. 

We  generally  follow  the  HEW  rules  in 
45  CFR  5b.5  on  access  to  an  individual’s 
record.  However,  in  a  few  situations  our 
rules  are  somewhat  more  strict,  because 
of  the  especially  sensitive  nature  of 
many  of  our  records.  This  subpart 
briefly  describes  our  rules. 

§  401.405  How  to  get  your  own  record. 

(a)  Who  may  ask.  You  may  ask  for 
any  record  about  yourself  that  is  in  an 
SSA  system  of  records.  If  you  are  a 
minor,  you  may  get  information  about 
yourself  under  the  same  rules  as  for  an 
adult.  If  you  are  the  parent  or  guardian 
of  a  minor,  or  the  legal  guardian  of 
someone  who  has  been  declared  legally 
incompetent,  you  may  ask  for 
information  on  behalf  of  that  individual. 
See  §  401.410  for  the  rules  which  apply 
to  requests  for  medical  records. 

(b)  Identification.  When  you  request 
access  to  a  record,  you  must  identify 
yourself.  One  means  of  identity  is  your 
signature. 

(c)  How  to  ask.  One  way  to  request 
access  to  a  record  is  by  writing  to  the 
manager  of  the  SSA  system  of  records. 
The  name  and  address  of  the  manager  of 
the  system  is  part  of  the  notice  of 
systems  of  records  which  is  published 
annually  in  the  Federal  Register.  Every 
local  social  security  office  keeps  a  copy 
of  the  Federal  Register  containing  that 
notice.  That  office  can  also  help  you  get 
access  to  your  record.  You  do  not  need 
to  use  any  special  form  to  ask  for  a 
record  about  you  in  our  files,  but  your 
request  must  give  enough  identifying  . 
information  about  the  record  you  want 
to  enable  us  to  find  your  particular 
record.  This  identifying  information 
should  include  the  system  of  records  in 
which  the  record  is  located  and  the 
name  and  social  security  number  (or 
other  identiBer)  under  which  the  record 
is  Bled.  We  do  not  honor  requests  for 
“all  records,"  “all  information,”  or 
similar  blanket  requests. 

§  401.410  Medical  information. 

(a)  Your  own  record.  When  you 
request  medical  information  about 
yourself,  you  must  also  name  a 
representative  in  writing.  The 
representative  may  be  a  physician,  other 
health  professional,  or  other  responsible 
individual  who  would  be  willing  to 
review  the  record  and  inform  you  of  its 
contents  at  your  representative’s 
discretion.  If  you  do  not  designate  a 
representative,  we  may  decline  to  give 
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you  the  information.  However,  there  is 
some  medical  information  you  may 
request  which  we  may  give  directly  to 
you. 

(b)  Bequests  on  behalf  of  a  minor.  If 
you  are  the  parent  or  guardian  of  a 
minor,  we  will  release  the  minor's 
medical  record  only  to  a  representative 
that  you  name  in  writing.  The 
representative  in  these  cases  must  be  a 
physician  or  other  health  professional 
(excluding  a  family  member]  who  would 
be  willing  to  review  the  record  and 
inform  you  of  its  contents  at  the 
representative's  discretion.  If  you  do  not 
designate  a  representative,  we  may 
decline  to  give  you  the  information.  We 
will  also  make  reasonable  efforts  to 
inform  the  minor  that  the  record  has 
been  given  to  the  representative.  We 
will  also  tell  the  representative  that 
further  disclosure  may  be  an 
unwarranted  invasion  of  the  minor's 
privacy. 

(c)  Requests  on  behalf  of  an 
incapacitated  adult  If  you  are  the  legal 
guardian  of  an  adult  who  has  been 
declared  legally  incompetent,  you  may 
receive  his  or  her  recoMs  directly. 

§  401.415  Records  about  two  or  more 
individuals. 

(a)  When  information  about  two  or 
more  individuals  is  in  one  record  filed 
under  your  social  security  number,  you 
may  receive  the  information  about  you 
and  the  fact  of  entitlement  and  the 
amount  of  benefits  payable  to  other 
persons  based  on  your  record. 

(b)  When  there  is  information  about 
yourself  hied  under  someone  else's 
social  security  number,  you  may  receive 
all  information  about  yourself  as  if  it 
were  filed  under  your  own  number. 

§401.420  How  to  correct  your  record. 

(a)  How  to  request  a  correction.  This 
section  appUes  to  all  records  kept  by 
SSA  (as  described  in  §  401.105}  except 
for  records  of  earnings.  (Section  422.125 
of  this  chapter  describes  how  to  request 
correction  of  your  earnings  record.)  You 
may  request  that  your  record  be 
corrected  or  amended  if  you  believe  that 
the  record  is  not  accurate,  timely, 
complete,  relevant,  or  necessary  to  the 
administration  of  a  social  security 
program.  To  amend  or  correct  your 
record,  you  should  write  to  the  manager 
identified  in  the  notice  of  systems  of 
records  which  is  published  annually  in 
the  Federal  Register  (see  §  401.405(c}  on 
how  to  locate  this  information).  You 
should  submit  any  available  evidence  to 
support  youE.request.  Your  request 
should  indicate — 

(1)  The  system  of  records  from  which 
the  record  is  retrieved: 


(2)  The  particular  record  which  you 
want  to  correct  or  amend; 

(3)  Whether  you  want  to  add,  delete 
or  substitute  information  in  the  record; 
and 

(4)  Why  you  want  to  correct  or  amend 
the  record. 

(b)  What  we  will  not  change.  You 
cannot  use  the  correction  process  to 
alter,  delete,  or  amend  information 
which  is  accurate,  timely,  or  relevant  to 
a  determination  of  fact.  Disagreements 
with  these  determinations  are  to  be 
resolved  through  the  SSA  appeal 
process.  However,  you  may  submit  a 
statement  on  why  you  think  certain 
information  should  be  altered,  deleted, 
or  amended,  and  this  will  be  made  part 
of  your  file. 

(c)  Acknowledgement  of  correction 
request.  We  will  acknowledge  receipt  of 
a  correction  request  within  10  working 
days,  unless  the  request  can  be 
reviewed,  processed,  and  an  initial 
determination  of  denial  or  compliance 
given  before  that  time. 

(d)  Notice  of  error.  If  the  record  is 
wrong,  we  will  correct  it  promptly.  If 
wrong  information  was  disclosed  from 
the  record,  we  will  tell  all  those  who 
received  that  information  that  it  was 
wrong  and  will  give  them  the  correct 
information.  This  will  not  be  necessary 
if  the  change  is  not  due  to  an  error,  e.g., 
a  change  of  name  or  address. 

(e)  Record  found  to  be  correct  If  the 
record  is  correct,  we  will  advise  you  in 
writing  of  the  reason  why  we  refuse  to 
amend  your  record  and  we  will  also 
inform  you  of  your  right  to  seek  a  review 
of  the  refusal  and  the  name  and  address 
of  the  official  to  whom  you  should  send 
your  request  for  review. 

Subpart  E — Appeals 

§  401.500  Which  decisions  are  covered. 

This  subpart  describes  how  to  appeal 
decisions  concerning  requests  for 
correction  of  a  record,  disclosure  of  a 
record,  or  access  to  a  record. 

§  401.505  Appeal  of  refusal  to  correct  a 
record. 

(a)  If  we  deny  your  request  to  correct 
a  record,  you  may  request  a  review  of 
that  decision.  As  discussed  in 

§  401.420(e),  our  letter  denying  your 
request  will  tell  you  to  whom  to  write. 

(b)  The  official  will  review  your 
request  within  30  working  days  from  the 
date  of  receipt.  However,  for  a  good 
reason  and  with  the  approval  of  the 
Commissioner,  this  time  limit  may  be 
extended  an  additional  30  days.  In  that 
case,  the  official  will  notify  you  about 
the  delay  and  when  the  review  is 
expected  to  be  completed.  If,  after 
review,  the  official  determines  that  the 


record  should  be  corrected,  the  record 
will  be  corrected.  If,  after  review,  the 
reviewing  official  also  refuses  to  amend 
the  record  exactly  as  you  requested,  the 
official  will  advise  you — 

(1)  That  your  request  has  been  refused 
and  the  reason; 

(2)  I'hat  this  refusal  is  SSA's  final 
decision; 

(3)  That  you  have  a  right  to  seek  court 
review  of  this  request  to  amend  the 
record;  and 

(4)  That  you  have  a  right  to  file  a 
statement  of  disagreement  with  the 
decision.  Your  statement  should  include 
the  reason  you  disagree.  Your  statement 
will  be  made  available  to  anyone  to 
whom  the  record  is  subsequently 
disclosed,  together  with  a  statement  of 
SSA's  reasons  for  refusal  to  amend  the 
record.  Also,  prior  recipients  of  the 
record  will  be  provided  a  copy  of  your 
statement. 

§401.510  Appeals  after  denial  of 
disclosure  or  access. 

(a)  If  we  deny  your  request  for 
disclosure  of  information  about  others 
or  for  access  to  your  ow'n  record,  you 
may  appeal  to  the  Commissioner  of 
Social  Security,  6401  Security  Boulevard. 
Baltimore.  Maryland  21235,  within  30 
days  after  you  receive  the  notice 
denying  your  request  or  only  partially 
allowing  your  request. 

(b)  The  Commissioner  will  mail  you  a 
written  decision  on  your  appeal.  This 
decision  will  state  why  the  decision  was 
made  and  will  explain  your  rights  to 
have  the  matter  heard  in  court. 

(c)  If  the  Commissioner  affirms  the 
denial  of  a  request  for  records 
(completely  or  partially),  or  fails  to 
comply  with  the  time  limits  that  apply  in 
FOIA  cases,  you  may  ask  to  have  the 
matter  reviewed  in  a  Federal  district 
court. 
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